Техническая информация
Для обеспечения автозапуска и распространения:
Модифицирует следующие ключи реестра:
- [<HKLM>\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon] 'Userinit' = '<SYSTEM32>\Userinit.exe,<SYSTEM32>\Kidd.exe -Run'
Вредоносные функции:
Создает и запускает на исполнение:
- '<SYSTEM32>\Kidd.exe' -Run
Запускает на исполнение:
- '<SYSTEM32>\cmd.exe' /c <Текущая директория>\Kill.BAT
Изменения в файловой системе:
Создает следующие файлы:
- <Текущая директория>\Kill.BAT
- <SYSTEM32>\Kidd.exe
Удаляет следующие файлы:
- %TEMP%\~DF907.tmp
Самоудаляется.
Сетевая активность:
UDP:
- DNS ASK 17#.16.69
- '17#.#6.69.17':2000
- '17#.#6.69.170':2000
- '17#.#6.69.174':2000
- '17#.#6.69.172':2000
- '17#.#6.69.164':2000
- '17#.#6.69.162':2000
- '17#.#6.69.168':2000
- '17#.#6.69.166':2000
- '17#.#6.69.176':2000
- '17#.#6.69.188':2000
- '17#.#6.69.186':2000
- '17#.#6.69.19':2000
- '17#.#6.69.190':2000
- '17#.#6.69.180':2000
- '17#.#6.69.178':2000
- '17#.#6.69.184':2000
- '17#.#6.69.182':2000
- '17#.#6.69.160':2000
- '17#.#6.69.138':2000
- '17#.#6.69.136':2000
- '17#.#6.69.142':2000
- '17#.#6.69.140':2000
- '17#.#6.69.13':2000
- '17#.#6.69.130':2000
- '17#.#6.69.134':2000
- '17#.#6.69.132':2000
- '17#.#6.69.144':2000
- '17#.#6.69.154':2000
- '17#.#6.69.152':2000
- '17#.#6.69.158':2000
- '17#.#6.69.156':2000
- '17#.#6.69.148':2000
- '17#.#6.69.146':2000
- '17#.#6.69.15':2000
- '17#.#6.69.150':2000
- '17#.#6.69.234':2000
- '17#.#6.69.232':2000
- '17#.#6.69.238':2000
- '17#.#6.69.236':2000
- '17#.#6.69.228':2000
- '17#.#6.69.226':2000
- '17#.#6.69.23':2000
- '17#.#6.69.230':2000
- '17#.#6.69.240':2000
- '17#.#6.69.25':2000
- '17#.#6.69.250':2000
- '17#.#6.69.254':2000
- '17#.#6.69.252':2000
- '17#.#6.69.244':2000
- '17#.#6.69.242':2000
- '17#.#6.69.248':2000
- '17#.#6.69.246':2000
- '17#.#6.69.224':2000
- '17#.#6.69.202':2000
- '17#.#6.69.200':2000
- '17#.#6.69.206':2000
- '17#.#6.69.204':2000
- '17#.#6.69.194':2000
- '17#.#6.69.192':2000
- '17#.#6.69.198':2000
- '17#.#6.69.196':2000
- '17#.#6.69.208':2000
- '17#.#6.69.218':2000
- '17#.#6.69.216':2000
- '17#.#6.69.222':2000
- '17#.#6.69.220':2000
- '17#.#6.69.21':2000
- '17#.#6.69.210':2000
- '17#.#6.69.214':2000
- '17#.#6.69.212':2000
- '17#.#6.69.128':2000
- '17#.16.69.4':2000
- '17#.#6.69.40':2000
- '17#.#6.69.44':2000
- '17#.#6.69.42':2000
- '17#.#6.69.34':2000
- '17#.#6.69.32':2000
- '17#.#6.69.38':2000
- '17#.#6.69.36':2000
- '17#.#6.69.46':2000
- '17#.#6.69.58':2000
- '17#.#6.69.56':2000
- '17#.16.69.6':2000
- '17#.#6.69.60':2000
- '17#.#6.69.50':2000
- '17#.#6.69.48':2000
- '17#.#6.69.54':2000
- '17#.#6.69.52':2000
- '17#.#6.69.30':2000
- '17#.16.69.9':2000
- '17#.16.69.7':2000
- '17#.#6.69.12':2000
- '17#.#6.69.10':2000
- '17#.16.69':2000
- '17#.16.69.1':2000
- '17#.16.69.5':2000
- '17#.16.69.3':2000
- '17#.#6.69.14':2000
- '17#.#6.69.24':2000
- '17#.#6.69.22':2000
- '17#.#6.69.28':2000
- '17#.#6.69.26':2000
- '17#.#6.69.18':2000
- '17#.#6.69.16':2000
- '17#.16.69.2':2000
- '17#.#6.69.20':2000
- '17#.#6.69.106':2000
- '17#.#6.69.104':2000
- '17#.#6.69.110':2000
- '17#.#6.69.108':2000
- '17#.#6.69.98':2000
- '17#.#6.69.96':2000
- '17#.#6.69.102':2000
- '17#.#6.69.100':2000
- '17#.#6.69.11':2000
- '17#.#6.69.122':2000
- '17#.#6.69.120':2000
- '17#.#6.69.126':2000
- '17#.#6.69.124':2000
- '17#.#6.69.114':2000
- '17#.#6.69.112':2000
- '17#.#6.69.118':2000
- '17#.#6.69.116':2000
- '17#.#6.69.94':2000
- '17#.#6.69.72':2000
- '17#.#6.69.70':2000
- '17#.#6.69.76':2000
- '17#.#6.69.74':2000
- '17#.#6.69.64':2000
- '17#.#6.69.62':2000
- '17#.#6.69.68':2000
- '17#.#6.69.66':2000
- '17#.#6.69.78':2000
- '17#.#6.69.88':2000
- '17#.#6.69.86':2000
- '17#.#6.69.92':2000
- '17#.#6.69.90':2000
- '17#.16.69.8':2000
- '17#.#6.69.80':2000
- '17#.#6.69.84':2000
- '17#.#6.69.82':2000
